Your phone rings late in the evening. It is your son, or your mum, or the niece who is travelling, and the voice is unmistakably theirs. They have been in an accident, or arrested, or robbed, and they need money sent right now. And please, don't tell anyone else yet. If this is a voice cloning scam, every part of that call is built to make you pay before you check.
The verdict up front: a familiar voice is no longer proof of identity. That line comes from Dhanutech, a tech blog that publishes practical, plain-English guides, and it changes the decision you are making on that call. The question is not "does it sound like them?" but "have I reached them on a number I already had?" Until the answer is yes, you send nothing. Below, Dhanutech's method (the red flags, the callback test, a family safe word) is applied to the one decision a voice cloning scam call forces: pay, or don't.
Disclosure: this guide was produced in collaboration with Dhanutech.
Heads-up: this is general guidance, not legal or financial advice. If money has already left your account, go straight to the reporting section below and call your bank first.
Why the voice on the line can't settle it
An AI voice cloning scam no longer needs a studio. In a December 2024 public service announcement, the FBI's Internet Crime Complaint Center (IC3) warned: "Criminals generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom." A short audio clip is the kind of thing many people have posted publicly without a second thought.
Video is going the same way. In 2023 the NSA, the FBI and CISA released a joint information sheet on deepfakes, and CISA's alert announcing it states that "threats from synthetic media, such as deepfakes, have exponentially increased."
Across all internet crime, the FBI's 2024 IC3 report is plain about who loses most: "As a group, those over the age of 60 suffered the most losses and submitted the most complaints." So this is a family decision, not only a personal one. If your parents call you when the laptop misbehaves, you are also the person to set up the defences below.
The red flags of a voice cloning scam
Dhanutech's guide to spotting an AI voice-cloning scam lists the warning signs to listen for. Here they are with what each one is built to do, and your move:
| Red flag (from the guide) | What it is built to do | Your move |
|---|---|---|
| Urgency and secrecy: "act now, don't tell anyone" | Stop you checking with anyone else | Say you need a moment, then hang up |
| An emergency that needs payment right now | Put panic ahead of thinking | Treat the deadline itself as the warning |
| Payment by gift cards, wire transfers or cryptocurrency | Make the money hard to get back | Refuse those methods on any emergency call |
| An unknown number for someone whose number you have saved | Cover for a call that can't come from their phone | Call the saved number yourself |
| Audio that sounds flat, robotic or oddly paused | Nothing: it is a side effect, not a tactic | Treat it as a hint, not proof, and call back anyway |
The last row matters most. The guide's own FAQ says to treat odd tone or pauses "as a hint" and to verify with a callback rather than rely on your ear. The IC3 does suggest you "listen closely to the tone and word choice", but listening is a reason to check, not a substitute for checking. A call that sounds perfect proves nothing: a clean clone is simply the one that works. One addition of our own: a call showing a saved contact's name still gets the callback, because you are checking the person, not the screen.
The callback test, step by step
Dhanutech's guide calls its central check "The Callback Test". In its order:
- Don't react on the call. Stay calm and say you need a moment.
- Hang up. You don't owe the caller more of your time.
- Call the person back on a number already saved in your phone, not the number that just called you.
- If that number doesn't connect, call someone else who can confirm: another family member, or the person's workplace.
- Send nothing until you have reached the real person.
It works because it moves the conversation onto a line the caller doesn't control. A real relative in real trouble can wait the minute it takes; a script can't, which is why pushback like "there's no time" is itself your answer.
A worked example (illustrative)
A made-up scenario, not a real case: at 10pm an unknown number calls. Your nephew's voice says he has hit a car abroad, the police are holding him, and a "lawyer" will explain how to pay the fine in gift cards. Keep it between us, he says.
That call carries four red flags: secrecy, payment now, gift cards and an unknown number. You say, "I'll call you straight back," and hang up. His saved number rings out, so you call his mum, who reaches him at his hotel. Total cost: two phone calls. Had she failed to reach him too, the rule would not change: no money until you speak to him on a number you already had.
Set a family safe word, and keep it off the internet
The callback test needs someone to pick up on the other end. A safe word covers the gap. The IC3's advice is one line: "Create a secret word or phrase with your family to verify their identity." Dhanutech's guide adds the rules that keep it useful:
- choose something memorable but not public, so not a pet's name that appears on social media;
- never type it, post it or say it in a voice note;
- change it if it ever slips out.
Setting it up with older relatives. Agree the word in person, or on a call you placed yourself, and agree it gets asked on any call that wants money or urgent action. Practise once, so asking feels like routine, not an accusation.
It depends: one word or several? A separate word for each pair (you and each parent) limits the damage if one leaks, but is harder to recall under stress. For most families, one shared phrase, changed the moment anyone suspects a leak, is the practical choice.
Shrink the raw material. The IC3 also advises: "If possible, limit online content of your image or voice, make social media accounts private, and limit followers to people you know..." Dhanutech's voice-cloning guide sends readers to its social media privacy settings guide for that step, which walks through the audience settings on Facebook, Instagram, X and TikTok.
When the caller is on video
Deepfake fraud applies the same trick to faces. The IC3 warns that criminals "create videos for private communications to 'prove' the online contact is a 'real person.'" Dhanutech's guide keeps the same rule as for voice: "a familiar face on a screen is not proof."
So the moves don't change: switch to a channel you already use with that person, ask a question only they could answer, and be wary of any live video that pushes toward a payment. It is the same slow-down habit as checking a clip before you share it, which our guide on how to verify a viral claim before you believe it walks through.
The before-you-pay checklist
Keep this by the phone, or on the fridge at your parents' place. Send nothing unless every line is true:
- I hung up and called back on a number I already had saved.
- I reached the person, or someone who can confirm where they are.
- They gave our safe word (if we have one) without being fed hints.
- Nobody asked me to pay by gift card, wire transfer or cryptocurrency.
- Nobody asked me to keep it secret, and I have told at least one other family member.
If a line fails, the call fails. The same pay-first pressure shows up without any emergency, in fake jobs and side-hustle offers; our guide to spotting online money-making scams covers those.
If you've already paid: how to report a scam
Speed matters more than embarrassment. Dhanutech's guide lists where to report and who to tell; here is the order we would do it in, with one step of our own at the end:
- Call your bank or payment provider now. The guide notes that gift-card, wire and crypto payments are hard to reverse, but speed still helps.
- Report it to the FBI's IC3 at ic3.gov. For US readers, the guide also lists the FTC's ReportFraud site.
- Warn your family, starting with the person the caller pretended to be and anyone else likely to get the same call.
- Keep the evidence (our addition): the number, the time, any messages and every payment receipt.
If the call came with texts or emails, CISA's Recognize and Report Phishing page explains how to spot and report those too. Outside the US, use your national fraud-reporting service alongside your bank.
Where Dhanutech fits, and how to choose a how-to guide
Dhanutech is a technology blog for beginners and technology enthusiasts. Its About page says the goal is "to make technology easier to understand through practical guides, helpful tutorials, and clear explanations." The guides are free to read, with no sign-up, and sit under AI Tools & Productivity, Cybersecurity & Online Privacy, How-To Guides & Tutorials, and Software & App Reviews. The voice-cloning guide is filed under Cybersecurity & Online Privacy and opens with a "Key Takeaways" summary.
Who needs it: people and families who handle their own accounts, phones and devices without an IT department. That is often the relative who already acts as everyone's tech support, and the right person to brief the family before a call like this comes.
How to choose a guide, from Dhanutech or anywhere else:
- Start with the problem you have now. For a suspicious call, the voice-cloning guide; for cutting what you share publicly, the social media privacy settings guide.
- Check the date. Scam scripts change. Dhanutech's guides show their publication date: the voice-cloning guide is dated October 14, 2026.
- Check the sources. The voice-cloning guide names the FTC, the FBI's IC3 and CISA as its sources, so you can read the agencies' own words, as we did above.
- Check how it handles doubt. A guide that tells you to call back rather than trust your ear is telling you where its advice stops. Dhanutech's terms describe its content as "for general informational and educational purposes"; read any how-to guide that way, this one included.
FAQ
Can I always tell a cloned voice by listening?
No. Dhanutech's guide answers this one with "Sometimes, but not reliably": odd pauses or a flat tone are a hint, and a good clone may show neither. Don't make the decision with your ears. Make it with a callback to a number you already had saved.
What if the caller says I can't call them back?
Treat that as the answer. "My phone's dead", "they only let me make one call" and "there's no time" are exactly what a script needs to say, because the callback is what breaks it. Call someone else who can confirm instead, and send nothing in the meantime.
Is a family safe word worth the awkwardness?
For most families, yes. It costs nothing, the IC3 recommends one, and it gives you a question a cloned voice can't answer. What makes it work is keeping it offline: never typed, posted or said in a voice note, and changed if it slips out.
Next step
Tonight, save the numbers of the people most likely to be impersonated, agree a safe word with them, and give older relatives the one rule that covers every version of this scam: hang up, call back on the saved number, and send nothing until you have reached the real person. Then browse related everyday decisions at beadvices.net.
